Medical associations warn: patient data accessible to hackers
27.06.2019 13:53
The medical associations MEDI GENO Germany, the Free Medical Association and the Free Association of German Dentists warn of security gaps in the telematics infrastructure (TI). The TI is the legally required networking platform of the German healthcare system. All German practices must have installed or at least ordered access to TI by June 30, 2019 - otherwise fees will be deducted. Insured person master data is already being compared in TI. In the future, patient files will be placed in the TI and possibly also saved. MEDI GENO Germany and other medical associations are filing a lawsuit.
Dr. Werner Baumgärtner, CEO of MEDI Baden-Württemberg and MEDI GENO Germany, had doubts about the security of the TI. That's why the MEDI association commissioned IT experts to test the technology. The computer scientists have thoroughly examined the protection profiles according to which the TI connectors are certified. “When examining the protection profiles, the experts found various unanswered questions about the security of the TI connector. In particular, even when properly installed, the connector does not reliably protect against attacks on the practice systems, although the National Association of Statutory Health Insurance Physicians (KBV) claims this to doctors,” says Baumgärtner.
No response to criticism - no answer to questions
With the results of the reports, Baumgärtner turned to the Federal Office for Information Security (BSI), the KBV and gematik (Society for Telematics Applications of the Health Card mbH), the provider of TI and the associated connectors, whose shareholders also include the Federal Ministry for Health counts. “Written inquiries did not provide an answer to the core question of what the connector really does as a firewall and how it protects the doctor information software from attacks from the TI. In the last answer from the KBV, which is based on statements from gematik, a protection profile was quoted that was not even applied to the current connectors,” reports Baumgärtner.
Doctors: Patient data must be protected
“We doctors criticize the insecure forced networking of all data in the German healthcare system, which has the potential to undermine medical confidentiality,” says Dr. Silke Lüder, deputy federal chairwoman of the Free Medical Association. She sees data protection and medical confidentiality as an important basis for the relationship of trust between practitioners and patients: “If my patient can no longer trust during the consultation that what he tells me about his health problems will stay in my consultation room, I can't work for him anymore. My patient will no longer tell me a lot of things and as a result I will no longer be able to take informative anamnesis or make correct diagnoses.”
Baumgärtner emphasizes that patient data must be protected at all costs: “Patient data is more sensitive than bank data. This is precisely why we are against any central storage of patient data. This is planned as the next step on the basis of an uncertain TI.”
“Unacceptable”: The practice owners are liable in the event of data protection mishaps
The practice owners would have to be liable for any consequences of security gaps in the “state-imposed TI connectors”. Baumgärtner finds this unacceptable: “Practices are being forced into a TI under penalty of law whose safety has not been adequately tested and for which crucial safety questions have not been answered. According to the GDPR, liability for data loss due to hacking lies with the practices and the patient data is not as secure as it should be.” MEDI GENO Germany is taking legal action “against state-enforced networking”.
It is unacceptable that the Social Security Code forces medical practices to connect to a telematics infrastructure where there are unresolved questions about the security of patient data, says Frank Hofmann, legal advisor and board member of MEDIVERBUND AG. “We therefore consider the obligation to install a TI connector to be legally inadmissible and are having the legality of the fee deductions examined in court,” says Hofmann, who coordinates the model lawsuits. “Our goal is to abolish the fee penalty through legal action. “Medical and psychotherapy practices can then decide against the TI connector and in favor of a more secure networking technology – without having to accept any financial losses,” he explains.
We also reserve the right to bring model lawsuits against those responsible for forcing us to connect to connectors if practices that are connected to the TI are hacked. “We cannot leave the affected practices alone at this point and will therefore, in the spirit of shared responsibility in accordance with the GDPR, support the practices in lawsuits – both against those responsible for the forced TI installation and against those who did not install correctly.” , adds Hofmann.
Doctors demand secure digital communication in medical operations
“Doctors have been using digitalized data for a long time and are using all forms of modern technology in practices and clinics. We demand secure digital communication in medical operations: encrypted end to end, without government access, without central storage - and every patient receives their medical data, as they do now,” says Lüder. Minister Spahn completely lost sight of the original objective of improved digital communication in the healthcare system. Instead, insecure cell phone communication is now being developed in a populist manner, with which confidentiality can no longer be guaranteed. “The new digital law from Spahn is a coercive law at the expense of patients and doctors,” said the general practitioner.
Penetration and white hacking tests prohibited under penalty of punishment
Many safety tests cannot be carried out because the medical profession's own tests are prohibited by law. “We also criticize that the security of the practices’ connection to the TI was not tested in a penetration test. The medical profession's own tests are prohibited by law. We would have carried out the PEN test at our own expense,” explains Baumgärtner.
Penetration testing was standard among the six testing methods used in security testing of software products and systems. They are stipulated in ISO 27034-1. “Each of these methods identifies different types of security vulnerabilities in hardware and also in each type of software. A system or product can only be released for use after a successful security test!” explains Prof. Dr. Hartmut Pohl, managing director of the cyber security consultancy softScheck GmbH.
Security gaps proven
“Patient data is easily accessible to hackers at the moment. And this despite the fact that health data is the most sensitive data we humans have in the long term,” emphasizes IT service provider Jens Ernst. During a security check for his customer, a doctor's practice, he introduced the EICAR test virus into the practice network in various ways via the properly connected TI connector. He also proved that the integrated firewall does not control communication and that all outgoing ports are open.